Malicious PDF — malware analysis report

Static analysis result for SHA-256 c31632efb3352b6f…

MALICIOUS

PDF

72.6 KB Created: 2021-03-19 06:03:22 +02:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-09-23
MD5: 95d34236b152e69bd5e50ec2cde0b7de SHA-1: 90bba00b1f4cf067ce0e7edf5ee28424e132ee4f SHA-256: c31632efb3352b6f3968fb20f79a8abb8e9961d8d1d4a66b884acd63ce00bb46
96 Risk Score
Tags
free-cdn-ebook-manual-lure

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds external URLs that direct users to attacker-controlled resources. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://lozipotod.ru/123?utm_term=handbook+of+psychological+assessment+5th+edition+pdf PDF link annotation
    • https://static.s123-cdn-static.com/uploads/4426409/normal_6008dfb4c42b0.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4479902/normal_60445a1bede86.pdfIn PDF document text
    • http://zisesir.22web.org/what_is_a_software_service_provider.pdfIn PDF document text
    • http://putoseba.iblogger.org/customer_service_week_2018_city_scramble_answers.pdfIn PDF document text
    • http://lagujegivupani.22web.org/94890954417.pdfIn PDF document text
    • https://cdn-cms.f-static.net/uploads/4424010/normal_604f52a3df174.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://uploads.strikinglycdn.com/files/e9685a52-5278-4c7d-8e0f-c8b41dd27653/bifunifat.pdfIn PDF document text
    • http://sibazod.epizy.com/50162304335.pdfIn PDF document text
    • https://s3.amazonaws.com/bulalowisu/noxirawosiwotewafadowu.pdfIn PDF document text
    • https://s3.amazonaws.com/kijelopazekune/15800251922.pdfIn PDF document text
    • https://s3.amazonaws.com/gazivemon/graphing_linear_inequalities_coloring_worksheet.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/e6108625-d806-4081-bfde-a330a59a3eab/76819241029.pdfIn PDF document text
    • http://vorasiwusiga.epizy.com/hp_envy_4500_ink_refill.pdfIn PDF document text
    • http://pejebitopaw.rf.gd/xunove.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/f8eb925b-fa23-48cf-a40d-35861ffae3fe/fufiv.pdfIn PDF document text
    • http://kasabapagikaki.rf.gd/skill_saw_blade_removal.pdfIn PDF document text
    • https://s3.amazonaws.com/tibitexil/learn_autocad_basics_in_21_days.pdfIn PDF document text
    • http://debolar.epizy.com/glands_in_human_body_and_their_functions_download.pdfIn PDF document text
    • http://mitudosukekunif.epizy.com/xodatolutimagafaseb.pdfIn PDF document text
    • http://bajewilogofiro.epizy.com/ipl_2019_schedule_time_table_list.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/8572289d-cb31-4dbb-9394-dd533b6293b6/re_zero_light_novel_volume_11_read_online.pdfIn PDF document text
    • https://uploads.strikinglycdn.com/files/2e65eaeb-7715-4fae-aba3-0eb296a90547/the_fallen_state_tv_dc_young_fly.pdfIn PDF document text
    • http://vatodulalidi.rf.gd/46461508538.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE0E 5864 bytes
SHA-256: 3e4a722e18315c957b8eb5fb01b42d06d9da799578d36852406a4afa47d6ec3c
font_01_sfnt_off0000f1ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF1EE 10168 bytes
SHA-256: 57c2e4c059a917ba2fbb5f6b88ac7554a025e425a20cc59f7e1f5994d061e822

Open this report in the interactive analyzer, or submit your own file for analysis.